fix(codex): identify live socket holders

[myobie]

What changed

• The Codex wrapper reads the connected socket peer PID from the kernel.
• The refusal reports the socket path, owner PID, parent PID, session ID, and ancestry.
• The wrapper compares the owner ancestry with the registered PTY runtime.
• Missing or incomplete evidence stays managed-holder.
• A detached message permits only an authorized TERM to the exact owner PID.
• A managed message forbids a signal and requires an ancestry report.

Why

The old refusal named only the socket path. An operator could not select a safe recovery action from that error.

This change adds diagnostics only. It does not clean up a process or change supervisor retry behavior. Issue #260 tracks the separate cleanup defect.

Closes #331.

Proof

The red commit is 49e02b2. It proves that the old error hides the holder facts.

• cargo test --lib -- --test-threads=1 (456 passed; one subprocess helper ignored)
• cargo test --test codex_app_server (4 passed)
• cargo test --test targeted_reconcile (3 passed)
• Five focused owner and guidance regressions passed.
• rustfmt --edition 2024 --check src/codex_app_server.rs
• git diff d4ba08c..HEAD --check

The Linux peer test proves that kernel credentials return the listener PID. The macOS path uses LOCAL_PEERPID and the existing proc_pidinfo interface.

[schickling-assistant]

Superseded by the broader Codex app-server ownership work in #386. Any unique diagnostics should be folded there rather than maintaining a competing process-ownership model.

Posted on behalf of @schickling

field	value
agent_identity	dev3.direct.omp.jmg9x29x
session	dev3.jmg9x29x
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.0.11
agent_runtime	OMP 18.0.11
tooling_profile	dotfiles@2161b9c